OESA-2025-1999

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1999

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2025-1999.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2025-1999

Upstream

CVE-2023-46136

Published

2025-08-15T12:39:20Z

Modified

2025-08-15T16:47:53.548845Z

Summary

python-werkzeug security update

Details

A comprehensive WSGI web application library

Security Fix(es):

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.(CVE-2023-46136)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:24.03-LTS / python-werkzeug

Package

Name: python-werkzeug
Purl: pkg:rpm/openEuler/python-werkzeug&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.3-4.oe2403

Ecosystem specific

{
    "src": [
        "python-werkzeug-2.2.3-4.oe2403.src.rpm"
    ],
    "noarch": [
        "python-werkzeug-help-2.2.3-4.oe2403.noarch.rpm",
        "python3-werkzeug-2.2.3-4.oe2403.noarch.rpm"
    ]
}